RHBA-2015:0597 - Bug Fix Advisory

Topic

Updated openldap packages that fix several bugs and add two enhancements are now
available for Red Hat Enterprise Linux 7.

Description

OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP)
applications and development tools. LDAP is a set of protocols used to access
and maintain distributed directory information services over an IP network. The
openldap packages contain configuration files, libraries, and documentation for
OpenLDAP.

This update fixes the following bugs:

• Previously, the ldap.conf(5) man page contained an incorrect description for

the "TLS_REQCERT" parameter. This update corrects the "TLS_REQCERT" description
in the man page. (BZ#1027613)

• Previously, due to a missing dependency on the "rpm" package, no certificates

were generated in the /etc/openldap/certs/ directory under certain
circumstances, and the directory was empty. This update adds the package
dependency on "rpm" to openldap, and certificates are now correctly generated
and present in /etc/openldap/certs/ after installing openldap. (BZ#1064251)

• Due to a typographical error, the "generate-server-cert.sh -h" script

sometimes resulted in displaying an error instead of the usage description. The
typographical error has been corrected, and openldap displays the usage
description as expected. (BZ#1087490)

• Previously, a helper script did not remove a temporary file with

security-relevant information. Consequently, it was possible to obtain the
information, which could compromise the generated certificate. The underlying
source code has been modified, and the temporary file is now removed as
expected. (BZ#1103101)

• Due to a missing object-path information in the database front-end

configuration, it was not possible to modify the front-end configuration by
standard means. The object-path information has been added, and the user now can
modify the front-end configuration by standard means. (BZ#1132094)

In addition, this update adds the following enhancements:

• This update adds a reference to the slapd documentation into the slapd service

file. Now, the user can easily display relevant documentation when interacting
with the slapd service running on a server from the command-line interface.
(BZ#1087288)

• Support for the Transport Layer Security protocol version 1.1 (TLSv1.1) and

later has been added in order to enable the latest secure transport.
(BZ#1160468)

Users of openldap are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1027613 - tls_reqcert try has bad behavior
• BZ - 1087288 - add documentation reference to slapd service file
• BZ - 1103101 - generate-server-cert.sh leaves security relevant tmp files behind
• BZ - 1132094 - slapd.ldif olcFrontend missing important/required objectclass
• BZ - 1160468 - support TLS 1.1 and later

CVEs

(none)

References

(none)